Chat now with support
Chat mit Support

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Adding an asset (desktop client)

NOTE: For information on adding an asset via the web client, see Adding an asset (web client).

It is the responsibility of the Asset Administrator to add assets and accounts to Safeguard for Privileged Passwords.

Safeguard for Privileged Passwords allows you to set up Asset Discovery jobs that run automatically. For more information, see Asset Discovery job workflow.

Before you add systems to Safeguard for Privileged Passwords, make sure they are properly configured. For more information, see Preparing systems for management.

NOTE: There are special considerations for adding an MS SQL asset to Safeguard. See KB 261806 for details.

( desktop client) To add an asset

  1. Navigate to Administrative Tools | Assets.
  2. Click Add Asset from the toolbar.
  3. In the dialog, provide information in each of the tabs:
    General tab (add asset desktop client)

    Where you add general information about the asset

    Management tab (add asset desktop client)

    Where you add the network address, operating system, and version information

    Account Discovery tab (add asset)

    Where you add the Account Discovery job

    Connection tab (add asset desktop client) Where you add the authentication type information or custom platform properties

    Attributes tab (add asset desktop client)

    (Directory assets) Where you add attributes to directory assets

Related Topics

Adding an account to an asset

Assigning an asset to a partition

Assigning a profile to an asset

Assigning assets or accounts to a password profile and SSH key profile

General tab (add asset desktop client)

Use the General tab to specify general information about the asset, including the partition and profile to which the asset is assigned. An asset can only be in one partition at a time. When you add an asset to a partition, all accounts associated with that asset are automatically added to that partition. All assets must be governed by a profile. New assets are automatically governed by the default profile unless otherwise specified.

Table 66: Asset: General properties
Property Description
Name

(Required) Enter a unique display name for the asset.

Limit: 100 characters

Description

(Optional) Enter information about this managed system.

Limit: 255 characters

Partition

Browse to select a partition for this asset. You can set a specific partition as the default, see Setting a default partition.

Password Profile

Browse to select a password profile to manage this asset's accounts.

You must assign all assets to a profile. All new assets are assigned to the default profile unless you specify another. You can set a specific profile as the default. For more information, see Setting a default profile.

Click Reset to set the profile to the current default.

The Reset button only becomes active when the asset has been explicitly assigned to the profile. If the asset is only implicitly assigned to the profile, the Reset button is not activated. If you do not explicitly assign an asset to a profile, it is always assigned to the current default profile.

SSH Key Profile

Browse to select an SSH key profile to manage this asset's accounts.

You must assign all assets to a profile. All new assets are assigned to the default profile unless you specify another. You can set a specific profile as the default. For more information, see Setting a default profile.

Click Reset to set the profile to the current default.

The Reset button only becomes active when the asset has been explicitly assigned to the profile. If the asset is only implicitly assigned to the profile, the Reset button is not activated. If you do not explicitly assign an asset to a profile, it is always assigned to the current default profile.

Management tab (add asset desktop client)

Use the Administrative Tools | Assets | Management tab to add the network address, operating system or directory service, and version information for an asset.

When you create a directory asset, accounts created display as discovered accounts in the Discovered Accounts properties grid. For more information, see Discovered Accounts.

The settings for an asset are shown below.

Table 67: Asset: Management tab properties (for example, Windows, Linux, LDAP, or Active Directory)
Property Description

Product

Select an operating system or directory service, for this asset.

A custom platform can be selected. For more information, see Custom platforms.

Generic operating system selections:

Safeguard for Privileged Passwords allows you to select a generic operating system of Other, Other Managed, Other Directory, or Linux. This allows you to add an asset to Safeguard for Privileged Passwords without designating a specific platform.

  • Other: An asset with an Other operating system cannot be managed. You can manually change passwords on accounts associated with an asset with an Other operating system. Safeguard for Privileged Passwords cannot connect to the asset so there is no automatic password or SSH key check and change, test connection, or other activity requiring a connection.
  • Other Managed: Safeguard for Privileged Passwords stores the password or SSH key and can automatically check and change it per the profile configuration. There is no active connection or service account. The passwords are rotated internally and event notifications are sent when the rotation is complete. Another component or piece of automation can change the password or SSH key or make use of the password or SSH key in configuration files. For example, a listener can pick up the change event via the Safeguard for Privileged Passwords Application to Application (A2A) service and perform actions, as required.

  • Other Directory: Other Directory supports the addition of directory properties at the asset and account levels. This allows for the accounts stored on them to be used in session policy via linked accounts or directory account using the access configuration settings. Since an Other Directory is not actually connected to a directory, it is unable to discover accounts or assets that belong to the actual directory that the Other Directory represents. Therefore, all accounts, assets, and credentials will have to be manually entered in Safeguard for Privileged Passwords.

    CAUTION: Since an Other Directory is not actually connected to a directory, you are responsible for making sure that the Other Directory assets and accounts stay in sync with the actual directory that the Other Directory represents.

    For example, if you change the password in Safeguard for Privileged Passwords the password will not be set in the actual directory. This will cause the account in Safeguard for Privileged Passwords to be out of sync with the account in the actual directory. Until manually corrected, you will be unable to use the password.

    IMPORTANT: Other Directory requires a one to one relationship between the directory and the domain. If your license is per system, this may result in a large number of licenses being required to fully support your assets.

  • Linux: Safeguard for Privileged Passwords manages an asset with "Linux" on a best effort basis.

Other platform details: Any Other platform type can be changed to a different platform type. Conversely, any platform type can be changed to Other; however, any property values specific to the current platform type will be lost. For example, you may want to change a Linux operating system to any type of Linux, such as AIX, HP-UX, or Solaris. Then, the specific platform type can be changed back to Other, if needed. 

Version

(Optional) Select the operating system version. When adding a Linux or Macintosh OS X system, Safeguard for Privileged Passwords allows you to choose an Other version. Custom platforms do not allow for a version to be selected.

Safeguard for Privileged Passwords does not manage passwords for accounts on domain controllers. Manage accounts on domain controllers through the directory asset that hosts the domain controller. For more information, see Adding an account to an asset.

Architecture

(Optional) The product's system architecture. Custom platforms do not allow for an architecture to be set.

Network Address

If applicable, enter a network DNS name or the IP address used to connect to the managed system over the network.

For Amazon Web Services assets, enter the Amazon AWS Account ID or Alias.

Domain Name (directory)

The domain for the asset (Name on the General tab). A domain can be identified for more than one directory asset so that multiple directory assets can be governed the same domain.

NetBios Name (Other Directory only)

The NetBios name of the asset.

Domain Unique Id (Other Directory only)

The unique domain identifier for the asset.

Naming Context (Other Directory only)

The naming context for the asset.

Manage Forest (Only available for some types of directory accounts)

Select if you want to manage the whole forest. Do not select if you want to manage just one domain.

Available for discovery across all partitions (Global Access)

If applicable, select to make this asset read-access available for Asset Discovery jobs beyond partition boundaries. Any partition that exists is able to use this directory asset. Other partition owners do not have read password or SSH key access. If not selected, partition owners and other partitions will not know the directory asset exists.

In setting up the Asset Discovery job, use the Directory asset discovery Method so that directory assets that are shared can be discovered into any partition. For more information, see General tab (asset discovery).

Enable Session Request

If applicable, this check box is selected by default, indicating that authorized users can request session access for this asset.

Clear this check box if you do not want to allow session requests for this asset. If an asset is disabled for sessions and an account on the asset is enabled for sessions, sessions are not available because the asset does not allow sessions.

Available for discovery across all partitions

Available for LDAP, Red Hat Directory Server and eDirectory LDAP assets; select this check box to allow the asset to be discovered across all partitions.

Manage using hashed password

Available for LDAP, Red Hat Directory Server and eDirectory LDAP assets; selecting this check box indicates password encryption will be performed by Safeguard when performing a Change Password operation.

Privileged Account

If the Product is Check Point GAiA, the Privileged Account is expert and the account is managed in Safeguard for Privileged Passwords as a unique Privileged Account. .

Advanced

 

Managed Network

The managed network that is assigned for work load balancing. For more information, see Managed Networks.

Specify Domain Controllers

(Only available for some types of directory accounts)

This value is set for a directory (such as Active Directory). To manage tasks and services on a Windows Domain Controller, you need to add a Windows Asset for the Domain Controller.

For Active Directory, instead of having Safeguard for Privileged Passwords automatically find domain controllers from a DNS and CLDAP ping, you can specify domain controllers.

In the desktop client, select Specify domain controllers.

In the text box, enter the network addresses, which may be DNS names or IP addresses, separated by spaces, commas, or semicolons. For Active Directory, if you have multi-domains, you must provide a domain controller for every domain. Do not enter the domain itself.

The domain controllers are used in the order entered. During the test connection from the Connection tab, if SPP does not find a domain controller in the list, the test connection fails and an error is returned.

During a process, if one domain controller does not respond, the processes continue with the next domain controller. The non-responsive domain controller is blocked for about 5 minutes.

RDP Session Port

If applicable, specify the access port on the target server to be used for RDP session requests.

Default: Port 3389

SSH Session Port

If applicable, specify the access port on the target server to be used for SSH session requests.

Default: Port 22

Telnet Session Port

If connecting to TN3270 or TN5250, the port for connection. By default, a telnet server typically listens on port 23.

Sync additions every [number] minutes

(directory)

Sync additions (incremental sync) syncs all changes except deletions. This is the faster type of sync.

For directory assets, enter or select how often you want to synchronize additions (in minutes). This updates Safeguard for Privileged Passwords with any additions or modifications that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 2147483647 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Enable or disable access request and services.

Sync deletions every [number] minutes

(directory)

Sync deletions (full sync) syncs all changes and deletions. This sync takes longer (perhaps hours), especially the first time it is run based on your directory setup.

For directory assets, enter or select how often you want Safeguard for Privileged Passwords to synchronize deletions (in minutes).

This updates Safeguard for Privileged Passwords with any additions, changes, and deletions that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

The default is 15 minutes and the range is between 1 and 1440 minutes.

Directory Sync is enabled by default and can be disabled. For more information, see Enable or disable access request and services.

You can run the deletion (full) sync on demand using the API Assets/Synchronize and IdentityProviders/Synchronize.

Connection tab (add asset desktop client)

On the Connection tab, choose an Authentication Type (see the table that follows) and specify the account credentials. The type of asset specified in the Product field on the Management tab determines the authentication types available for the asset. If the asset has a custom platform, the Custom Properties elements are displayed. For more information, see Custom platforms.

Table 68: Connection tab: Asset authentication types
Authentication Type Description
SSH Key (add asset desktop client) To authenticate to the asset using an SSH authentication key.
Directory Account (add asset desktop client)

To authenticate to the asset using a directory account from an external identity store such as Microsoft Active Directory.

NOTE: In order to use this authentication type, you must first add a directory asset and add domain user accounts. For more information, see Accounts.

Starling Connect (add asset desktop client)

To authenticate to the asset using a connector configured in Starling Connect.

NOTE: In order to use this authentication type, you must first register a Starling Connect connector. For more information, see Registered Connectors.

Local System Account (add asset desktop client)

For SQL Server assets, to authenticate to the asset using a local system account, which is a Windows user account on the server that is hosting the SQL database.

Password (local service account desktop client)

To authenticate to the asset using a local service account and password.

Account Password

When the function account credentials are not in the custom script, for example, Amazon Web Services. For more information, see Adding a cloud platform account.

Access Key (add asset desktop client)

For Amazon Web Services assets, to authenticate to the asset using an access key. For more information, see Adding a cloud platform account.

Custom

No authentication information is taken because the custom parameters or parameters in a customer platform script are used. No accounts associated with the asset are stored. For more information, see Custom platforms.

None

No authentication information is taken and check/change functions are disabled. No accounts associated with the asset are stored.

Safeguard for Privileged Passwords discovers the SSH host key of discovered assets even if you selected None as the service account credential type.

Test Connection

Verify that Safeguard can log in to the asset using the service account credentials that you have provided.

Timeout

Enter the connection timeout period.

Client ID: For SAP assets, enter the client ID.

Custom platform properties

If the Product field on the Management tab identified a custom platform, complete the dialog based on the custom properties of the custom platform script. Safeguard for Privileged Passwords checks to ensure the values match the type of the property that include a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms.For more information, see Creating a custom platform script.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen